The update channel is the real control surface

In July, Meta pushed a mandatory update that detects tampering with the capture LED and disables the camera when the light has been covered or destroyed. UploadVR covered how the tamper detection works and what it applies to, including the detail that it reaches hardware already modified in the field.

That is the good version of this. A safeguard was delivered to devices that had already been sold, without anyone buying anything, and it closed a gap that physical design alone had left open. We think it deserves the credit it received. It also demonstrates something less comfortable, which is that the behaviour of a camera on someone's face is set from a server, after the purchase, by a party who is not in the room.

Nobody in the room can read the version

A bystander forming a judgment about a pair of glasses is working from the model name, if they can even identify it, and whatever they last read about that model. There is no version number legible from two metres. There is no way to tell a unit running last year's build from one running this week's.

So a norm calibrated in March describes a device that stopped existing in April. The lever that hardened the LED can extend a capability just as easily, on the same schedule, with the same reach into hardware already in the world. Release notes go to the owner. The people the camera points at are not on that distribution list.

Announce capability changes to the public, not the customer

Our position is that any update which changes what a device can do to people who did not buy it belongs in a public notice, written for them, separate from the changelog. A feature that alters the terms of an encounter is not a product detail.

There is a consequence for detection work that we would rather state than dodge. Identifying a model tells you what the hardware is. It does not tell you what that unit currently does, and no scanner will ever read a firmware version off an advertising packet. Any tool in this space, ours included, describes the device and not its behaviour, and the gap between those two is set by whoever ships the next build.